@haverstack/core 0.42.0 → 0.43.0

package/dist/scoped-stack/authority-snapshot.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Authority snapshot
+ * -------------------------------------------------------
+ * The authority one request acts with, read once: the `_grant` Records,
+ * the roles the subject holds on rosters, and the reach each verb builds
+ * from them — each loaded on first use and shared after, so an operation
+ * reads each at most once however many Records it decides. An operation
+ * takes its own and drops it when done; a subscription holds one for its
+ * life, which is only safe because every write that can move it arrives as
+ * an event that clears it. See docs/spec/access-control.md § Reach.
+ */
+import type { RosterRoles } from '../access.js';
+import type { Reach, StackRecord } from '../types/index.js';
+/** The verbs a reach is built for: one per thing a request can do to a Record. */
+export type ReachVerb = 'create' | 'read' | 'update' | 'delete';
+export type AuthoritySources = {
+    grants: () => Promise<StackRecord[]>;
+    roles: RosterRoles;
+    reach: (verb: ReachVerb, snapshot: AuthoritySnapshot) => Promise<Reach>;
+};
+export declare class AuthoritySnapshot {
+    private readonly sources;
+    private readonly grantSet;
+    private readonly roleSet;
+    private readonly reaches;
+    constructor(sources: AuthoritySources);
+    readonly grants: () => Promise<StackRecord[]>;
+    readonly roles: RosterRoles;
+    reach(verb: ReachVerb): Promise<Reach>;
+    /**
+     * Drop whatever a change to `typeFamily` can move, and every reach built
+     * from it. A load already in flight still answers the event that started
+     * it, which precedes the write; the next question loads afresh.
+     */
+    invalidateFor(typeFamily: string): void;
+}
+//# sourceMappingURL=authority-snapshot.d.ts.map

package/dist/scoped-stack/authority-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-snapshot.d.ts","sourceRoot":"","sources":["../../src/scoped-stack/authority-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5D,kFAAkF;AAClF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACrC,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;CACzE,CAAC;AAEF,qBAAa,iBAAiB;IAKhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;gBAEhC,OAAO,EAAE,gBAAgB;IAKtD,QAAQ,CAAC,MAAM,QAAO,OAAO,CAAC,WAAW,EAAE,CAAC,CAAwB;IACpE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAA4B;IAEvD,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;IAStC;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;CAMxC"}

package/dist/scoped-stack/authority-snapshot.js

@@ -0,0 +1,49 @@
+/**
+ * Authority snapshot
+ * -------------------------------------------------------
+ * The authority one request acts with, read once: the `_grant` Records,
+ * the roles the subject holds on rosters, and the reach each verb builds
+ * from them — each loaded on first use and shared after, so an operation
+ * reads each at most once however many Records it decides. An operation
+ * takes its own and drops it when done; a subscription holds one for its
+ * life, which is only safe because every write that can move it arrives as
+ * an event that clears it. See docs/spec/access-control.md § Reach.
+ */
+import { Lazy } from '../lazy.js';
+import { SYSTEM_TYPES } from '../types/index.js';
+export class AuthoritySnapshot {
+    sources;
+    grantSet;
+    roleSet;
+    reaches = new Map();
+    constructor(sources) {
+        this.sources = sources;
+        this.grantSet = new Lazy(sources.grants);
+        this.roleSet = new Lazy(sources.roles);
+    }
+    grants = () => this.grantSet.get();
+    roles = () => this.roleSet.get();
+    reach(verb) {
+        let reach = this.reaches.get(verb);
+        if (!reach) {
+            reach = new Lazy(() => this.sources.reach(verb, this));
+            this.reaches.set(verb, reach);
+        }
+        return reach.get();
+    }
+    /**
+     * Drop whatever a change to `typeFamily` can move, and every reach built
+     * from it. A load already in flight still answers the event that started
+     * it, which precedes the write; the next question loads afresh.
+     */
+    invalidateFor(typeFamily) {
+        if (typeFamily === SYSTEM_TYPES.GRANT)
+            this.grantSet.clear();
+        else if (typeFamily === SYSTEM_TYPES.GROUP)
+            this.roleSet.clear();
+        else
+            return;
+        this.reaches.clear();
+    }
+}
+//# sourceMappingURL=authority-snapshot.js.map

package/dist/scoped-stack/authority-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-snapshot.js","sourceRoot":"","sources":["../../src/scoped-stack/authority-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAajD,MAAM,OAAO,iBAAiB;IAKC;IAJZ,QAAQ,CAAsB;IAC9B,OAAO,CAAyC;IAChD,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;QACpD,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEQ,MAAM,GAAG,GAA2B,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC3D,KAAK,GAAgB,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEvD,KAAK,CAAC,IAAe;QACnB,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAkB;QAC9B,IAAI,UAAU,KAAK,YAAY,CAAC,KAAK;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;aACxD,IAAI,UAAU,KAAK,YAAY,CAAC,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;;YAC5D,OAAO;QACZ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/scoped-stack/authority.d.ts

@@ -8,9 +8,12 @@
  * writes. See docs/spec/access-control.md § Delegation: principal and
  * subject.
  */
-import type { AccessMode } from '../access.js';
+import type { ReachedRecord } from '../adapter/reach.js';
 import { StackError } from '../errors.js';
-import type { Actor, EntityId, GrantAction, GroupRole, StackRecord, TypeId } from '../types/index.js';
+import type { SplitQuery } from '../query-validation.js';
+import { AuthoritySnapshot } from './authority-snapshot.js';
+import type { ReachVerb } from './authority-snapshot.js';
+import type { Actor, EntityId, QueryResult, Reach, StackRecord, TypeId } from '../types/index.js';
 import type { Stack } from '../stack/stack.js';
 export declare class ScopeAuthority {
     private readonly stack;
@@ -18,14 +21,22 @@ export declare class ScopeAuthority {
     readonly principalId: EntityId | null;
     /** Whom this request acts for and attributes writes to — see ScopedStack.subjectId. */
     readonly subjectId: EntityId | null;
+    /** Stack.query() within a reach — see ScopedStack.query(). */
+    private readonly queryReadable;
     constructor(stack: Stack, 
     /** Whose grants bound what this request may do — see ScopedStack.principalId. */
     principalId: EntityId | null, 
     /** Whom this request acts for and attributes writes to — see ScopedStack.subjectId. */
-    subjectId: EntityId | null);
-    private readonly resolveRecord;
-    /** Every `_grant` Record — see loadGrantRecords(). */
-    readonly loadGrants: () => Promise<StackRecord[]>;
+    subjectId: EntityId | null, 
+    /** Stack.query() within a reach — see ScopedStack.query(). */
+    queryReadable: (split: SplitQuery, reach: Reach) => Promise<QueryResult>);
+    /**
+     * The authority this request acts with, for one operation: pass it to
+     * each check the operation makes, so the grants, the rosters and each
+     * verb's reach are read at most once. An anonymous request is named by no
+     * grant and held by no roster, so it reads neither.
+     */
+    snapshot(): AuthoritySnapshot;
     /** Whether a delegated app is acting for someone other than itself. */
     get delegated(): boolean;
     /**
@@ -50,48 +61,50 @@ export declare class ScopeAuthority {
      * See docs/spec/access-control.md § Delegation: principal and subject.
      */
     get ownerActingAlone(): boolean;
-    /** Whether the record's own permissions let the subject `mode` it. */
-    recordPermits(record: StackRecord, mode: AccessMode): Promise<boolean>;
     /**
-     * Whether `grantee` holds a _grant covering one of `actions` on the type's
-     * family. The flags are fixed per side of a delegation and mean nothing
-     * alone, so this is reached only through subjectAllows() and
-     * principalHolds(). See docs/spec/access-control.md § Who a grant reaches.
+     * Whether no grant bounds the principal: undelegated, it is the subject
+     * itself, and the owner as principal is the owner's own software.
+     * See docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    private get principalUnbounded();
+    /**
+     * The families `grantee`'s grants convey one of `actions` on, read the way
+     * `side` reads a grant. Only the subject's side counts a group, so the
+     * rosters read are always the subject's.
+     * See docs/spec/access-control.md § Who a grant reaches.
      */
-    private hasGrant;
+    private familiesConveying;
     /**
-     * The principal half of a delegated request's authority, which bounds
-     * what the subject's reaches so neither lends its reach to the other.
-     * Vacuously true without delegation. Default and group grants do not
-     * count — see docs/spec/access-control.md § Who a grant reaches.
+     * What this request may do with `verb` — that verb's rules, built whole
+     * even where a Record's own permissions would settle it, since every gate
+     * asks one value at a flat cost. The principal's grants fence it; within,
+     * the subject reaches what grants and permissions give it, an owner
+     * subject everything. See docs/spec/access-control.md § Reach.
      */
-    principalAllows(typeId: TypeId, actions: GrantAction[], prefetchedGrants?: StackRecord[]): Promise<boolean>;
+    private buildReach;
     /**
-     * principalAllows() without its shortcuts: whether the principal itself
-     * holds a grant naming it for these verbs, read the principal-side way.
-     * Also what an installed app's own migration authority rests on — see
-     * installMayMigrate().
+     * The permission elements carrying `bit` to the subject, as the sets a
+     * Record must hold whole. A `read` stands alone, as does `anyone`; a
+     * `write` stands beside one of its readCompanions().
      */
-    principalHolds(typeId: TypeId, actions: GrantAction[], prefetchedGrants?: StackRecord[]): Promise<boolean>;
+    private elementSets;
+    /** Whether this request may `verb` the Record: its reach, asked of one Record. */
+    may(verb: ReachVerb, record: ReachedRecord, snapshot: AuthoritySnapshot): Promise<boolean>;
     /**
-     * The subject half: which records are reachable, with `-own` matching and
-     * default grants in force — the ordinary reading of a grant, since the
-     * subject is the entity a grant is written about.
+     * may() with the principal's fence set aside — whether the subject alone
+     * reaches the Record, for a refusal that says which side lacked the verb.
      */
-    subjectAllows(typeId: TypeId, actions: GrantAction[], opts?: {
-        record?: StackRecord;
-        prefetchedGrants?: StackRecord[];
-        groupRoles?: Map<string, GroupRole | null>;
-    }): Promise<boolean>;
+    subjectMay(verb: ReachVerb, record: ReachedRecord, snapshot: AuthoritySnapshot): Promise<boolean>;
+    canRead(record: StackRecord, snapshot: AuthoritySnapshot): Promise<boolean>;
+    /** Whether this request may create a Record of the type, asked of the Record it would make. */
+    canCreate(typeId: TypeId, snapshot: AuthoritySnapshot): Promise<boolean>;
     /**
      * How to refuse a record this request addressed by ID: a permission error
      * to a requester who can read it, the not-found answer to anyone else, so
      * `message` only reaches someone holding the record already.
      * See docs/spec/disclosure.md § Which refusal a Record answers with.
      */
-    denialFor(record: StackRecord, message: string): Promise<StackError>;
-    canRead(record: StackRecord, prefetchedGrants?: StackRecord[], groupRoles?: Map<string, GroupRole | null>): Promise<boolean>;
-    checkCreateGrant(typeId: TypeId): Promise<boolean>;
+    denialFor(record: StackRecord, message: string, snapshot: AuthoritySnapshot): Promise<StackError>;
     /**
      * `_group` records are managed, not merely written: only the owner or an
      * `admin` roster holder may mutate them — ordinary write permissions and
@@ -107,28 +120,28 @@ export declare class ScopeAuthority {
      * owner acting alone skips the lookup and leaves absence to `Stack`.
      * See docs/spec/access-control.md § Reference-creation gating.
      */
-    canReadReferent(recordId: string): Promise<boolean>;
+    canReadReferent(recordId: string, snapshot: AuthoritySnapshot): Promise<boolean>;
     /**
      * Whether this request can read some record referencing `fileId`, other
      * than an `_attachment@1` record — otherwise one correct guess would
      * unlock unlimited further metadata records for the file.
      * See docs/spec/attachments.md § Creating `_attachment@1` records directly.
      */
-    hasReadableReference(fileId: string): Promise<boolean>;
+    hasReadableReference(fileId: string, snapshot: AuthoritySnapshot): Promise<boolean>;
     /**
      * Whether this request may reference or download `fileId` — the dual of
      * getAttachment()'s access rule. Nonexistent and inaccessible are
      * indistinguishable (both false), so no confirmation oracle for guessed
      * hashes. See docs/spec/access-control.md § Reference-creation gating.
      */
-    canAccessFile(fileId: string): Promise<boolean>;
+    canAccessFile(fileId: string, snapshot: AuthoritySnapshot): Promise<boolean>;
     /**
      * Whether this request is an installed app, acting as itself, migrating
      * `record` within families its one live install claims, to a version the
      * owner approved, holding `update-any` on each directly.
      * See docs/spec/apps.md § Migrating an installed app's types.
      */
-    installMayMigrate(record: StackRecord, toTypeId: TypeId): Promise<boolean>;
+    installMayMigrate(record: StackRecord, toTypeId: TypeId, snapshot: AuthoritySnapshot): Promise<boolean>;
     /** Names of the type's top-level file-ref fields — the content-reference half of referencesFileId matching. */
     fileRefFieldNames(typeId: TypeId): Promise<string[]>;
     /**

package/dist/scoped-stack/authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../src/scoped-stack/authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,UAAU,EAA4C,MAAM,cAAc,CAAC;AAiBpF,OAAO,KAAK,EACV,KAAK,EAGL,QAAQ,EACR,WAAW,EAEX,SAAS,EAET,WAAW,EACX,MAAM,EACP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE/C,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,QAAQ,GAAG,IAAI;IACrC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI;gBAJlB,KAAK,EAAE,KAAK;IAC7B,iFAAiF;IACxE,WAAW,EAAE,QAAQ,GAAG,IAAI;IACrC,uFAAuF;IAC9E,SAAS,EAAE,QAAQ,GAAG,IAAI;IAGrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CACiB;IAE/C,sDAAsD;IACtD,QAAQ,CAAC,UAAU,QAAO,OAAO,CAAC,WAAW,EAAE,CAAC,CAAiD;IAEjG,uEAAuE;IACvE,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;OAMG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,KAAK,GAAG,SAAS,CAKjC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,OAAO,CAK9B;IAED,sEAAsE;IACtE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE;;;;;OAKG;YACW,QAAQ;IAiEtB;;;;;OAKG;IACH,eAAe,CACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EAAE,EACtB,gBAAgB,CAAC,EAAE,WAAW,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC;IAMnB;;;;;OAKG;IACH,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EAAE,EACtB,gBAAgB,CAAC,EAAE,WAAW,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC;IAUnB;;;;OAIG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EAAE,EACtB,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;KACvC,GACL,OAAO,CAAC,OAAO,CAAC;IASnB;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAUpE,OAAO,CACX,MAAM,EAAE,WAAW,EACnB,gBAAgB,CAAC,EAAE,WAAW,EAAE,EAChC,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,GACzC,OAAO,CAAC,OAAO,CAAC;IAYb,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQxD;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO;IAK5C,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAMpB;;;;;OAKG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOzD;;;;;OAKG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB5D;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6CrD;;;;;OAKG;IACG,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmChF,+GAA+G;IACzG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK1D;;;;;OAKG;IACH,cAAc,IAAI,OAAO;IAIzB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAKlB;;;;;OAKG;IACH,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO;CAKzC"}
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../src/scoped-stack/authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,UAAU,EAA4C,MAAM,cAAc,CAAC;AAQpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAWzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,KAAK,EACV,KAAK,EAKL,QAAQ,EAKR,WAAW,EACX,KAAK,EACL,WAAW,EACX,MAAM,EACP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AA0B/C,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,QAAQ,GAAG,IAAI;IACrC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI;IACnC,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa;gBANb,KAAK,EAAE,KAAK;IAC7B,iFAAiF;IACxE,WAAW,EAAE,QAAQ,GAAG,IAAI;IACrC,uFAAuF;IAC9E,SAAS,EAAE,QAAQ,GAAG,IAAI;IACnC,8DAA8D;IAC7C,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,WAAW,CAAC;IAG3F;;;;;OAKG;IACH,QAAQ,IAAI,iBAAiB;IAa7B,uEAAuE;IACvE,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;OAMG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,KAAK,GAAG,SAAS,CAKjC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,OAAO,CAK9B;IAED;;;;OAIG;IACH,OAAO,KAAK,kBAAkB,GAE7B;IAED;;;;;OAKG;YACW,iBAAiB;IA4B/B;;;;;;OAMG;YACW,UAAU;IA0BxB;;;;OAIG;YACW,WAAW;IAuBzB,kFAAkF;IAC5E,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhG;;;OAGG;IACG,UAAU,CACd,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC;IAKnB,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAI3E,+FAA+F;IAC/F,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxE;;;;;OAKG;IACG,SAAS,CACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAAC,UAAU,CAAC;IAKtB;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO;IAK5C,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAMpB;;;;;OAKG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOtF;;;;;OAKG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAYzF;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IA4ClF;;;;;OAKG;IACG,iBAAiB,CACrB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC;IAkCnB,+GAA+G;IACzG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK1D;;;;;OAKG;IACH,cAAc,IAAI,OAAO;IAIzB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAKlB;;;;;OAKG;IACH,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO;CAOzC"}